[ Sending-service guides ]

Authenticate email sent through Exclaimer: configuration and verification

Verify Exclaimer server-side mail routing with regional SPF authorization and DKIM applied by the final sending platform after signature processing.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Exclaimer modifies signatures but is not the final DKIM signer.
  • Use the subscription region for SPF authorization.
  • Test the external route after all content transformations.
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Test the external route after all content transformations.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Verify the final signer

The last content-changing service determines where signing must be effective.

Next steps

  1. Map the entire route including gateways.
  2. Separate missing, invalid and unaligned DKIM diagnoses.
  3. Verify the subscription region before SPF edits.

CISO / SecOps

Avoid invented controls

Neither an Exclaimer DKIM key nor ARC sealing should be assumed.

Next steps

  1. Review the actual trust boundaries.
  2. Require aligned results from the final external delivery path.
  3. Do not expand relay access as a troubleshooting shortcut.

Founder / Non-technical

Keep signatures from disrupting delivery

A branding change can affect the message-processing route.

Next steps

  1. Require a controlled external test.
  2. Assign a recovery owner before rollout.
  3. Keep the old approved mail route recoverable.

[ FAQs ]

Frequently asked questions

Where is the Exclaimer DKIM selector?

The documented server-side service does not provide customer DKIM signing. Configure and verify the final Microsoft 365 or Google Workspace signer.

Exclaimer server-side DKIM behavior

Why can an earlier signature disappear?

Applying a server-side signature changes the message. The documented route removes the earlier DKIM signature and relies on the final platform to sign afterward.

Exclaimer server-side DKIM behavior

Does Exclaimer ARC-seal the message?

Its current documentation says it does not. Do not use an assumed ARC seal as the acceptance criterion.

Exclaimer server-side DKIM behavior

Which regional SPF include should I use?

Use the subscription region verified by an Exclaimer Admin, not the recipient location or a copied example.

Exclaimer regional SPF configuration

Does client-side-only use need this same routing change?

Do not assume so. This guide targets server-side routing; first establish whether mail actually traverses Exclaimer.

Exclaimer regional SPF configuration

Does a passing final DKIM signature always align?

No. Compare its signing domain with the visible From under the applicable alignment mode.

Is an internal message a sufficient test?

No. Verify the production-equivalent external route and retain its trusted receiver results.

Exclaimer server-side DKIM behavior

Should I rotate keys as soon as lookup fails?

First check authoritative DNS, owner names, record types and current provider values. Rotate only through the supported process when the diagnosis calls for it.

Exclaimer server-side DKIM behavior

[ Sources ]

Sources

  1. Exclaimer regional SPF configuration

    Sections Updating Sender Policy Framework · Checking your region code; Microsoft365 versus Google region tables

  2. Exclaimer server-side DKIM behavior

    Sections Reason and Resolution: signature removal, no signing/ARC · Troubleshooting: final-platform DNS and external test

  3. RFC 7208 SPF

    Sections §2.4 Checking authorization · §3.2 Multiple DNS records · §4.6.4 DNS lookup limits

  4. RFC 6376 DKIM

    Sections §3.5 DKIM-Signature header · §3.6.2 DNS binding · §6 Verifier actions

  5. RFC 9989 DMARC

    Sections §4.4 Identifier alignment · §4.10 DNS tree walk · §5.3.5 Determine DMARC pass or fail

[ Glossary ]

Glossary

SPF
Authorization of the connecting sender for an SMTP envelope domain, subject to protocol evaluation limits.
DKIM
A signature that authenticates a signing domain and protects selected message content.
DMARC alignment
The relationship required between the visible From domain and an authenticated SPF or DKIM domain.
Selector
The DKIM identifier used with the signing domain to locate the public key.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base